Re: [DNSOP] Tell me about tree walks

[Paul Vixie <[e-mail]>]

On Wed, Nov 11, 2020 at 10:38:12PM +0000, Tony Finch wrote:
> Paul Vixie <[e-mail]> wrote:
> >
> > i'd like to be able to filter inbound traffic based on who paid the
> > money for a domain, who got that money, or whether either of them
> > wishes to remain anonymous.
> 
> The crucial difference is that CAA/DMARC are consensual: the publisher and
> the checker both want to use the protocol to stop baddies doing bad
> things. But your situation is more adversarial: you (the checker) want to
> find out if the publisher is good or bad.

did you see army of darkness? do you remember what Ash said about good/bad?

> There's not much chance of success trying to use a protocol designed for
> friendlies in situations of distrust, let alone active combat!

i guess i'll go another couple of rounds with this, even if it means
answering what i haven't said after somebody ignores what i did say.

forget about why i want it, if that helps. or, if you're willing, imagine
a world where registrars who want to be associated with the domains they
sell clearly mark those domains with their identifier, and others, not so.

* * *

here's what i know. there are registrars who are proud of their business
practices and policies, who despise their race-to-the-bottom competitors
as much as anybody could. but they have no way to differentiate themselves
since the third parties who are satisfied by a takedown never tell anybody.

the ietf has offered these registrars no in-band at-scale on-the-wire method
to demonstrate greater care in their output. i'm not sure why we would
expect an industry to improve itself without metrics supporting
differentiation.

same goes for registrants. if we want differentiated acceptance levels for
new domains based on whether the registrar and registrant are willing to
self-identify to an authentic reputation, we have to make it possible.

if social networks could put new account requests in a delay queue whenever
they can't identify the registrar or registrant, or if e-mail servers
could do likewise with arriving e-mail, then the cream would float to the
top, and everything else could be made to cost more and take longer. right
now reputation is only a bad thing, and accountability is _not_ improving.

but none of that matters for the purpose of extending the protocol. what
matters is just that there is no way for a registrar and/or registrant to
mark their domain with an identity. perhaps for registrants it's just RP?
perhaps for registrars it's a new schema for RP, appearing above the zone
cut or at some cousin name to avoid the DS problem?

i'm not asking that you adopt my economic vision, nor split any bosons.

-- 
Paul Vixie